Hackers activate automatic defrosting in supermarket fridges across Europe

Supermarket refrigeration systems are now demonstrably vulnerable to coordinated cyberattacks, raising the risk of spoiled inventory and operational disruptions.

A widespread cyberattack has disrupted refrigeration systems in major European supermarkets, primarily affecting stores in France, Belgium, and the Netherlands. Hackers reportedly exploited vulnerabilities in Danfoss-made refrigeration controls, causing units to continuously activate their defrosting cycles and reach temperatures as high as 50 degrees Celsius. This malfunction is not only spoiling perishable goods but also impacting delivery schedules and the electronic shelf labels used for in-store pricing. Several major retailers, including Intermarché, Leclerc, and Coopérative U, have confirmed the incident, with Coopérative U's president calling the attack "extremely serious" and initiating an investigation. The full extent of the damage and the perpetrators behind this coordinated attack remain under investigation.

This incident highlights a critical vulnerability in the operational technology (OT) used by essential service providers like supermarkets. The attack on refrigeration controls demonstrates that even systems not directly connected to the internet can be susceptible to disruption, potentially through supply chain compromises or shared network infrastructure. The financial and logistical fallout from spoiled goods and delivery delays could be substantial, prompting a re-evaluation of cybersecurity investments in the retail sector.

The coordinated nature of this attack suggests a sophisticated threat actor with a potential motive to cause widespread disruption rather than simply steal data. Retailers and their technology suppliers, such as Danfoss, will likely face increased scrutiny and pressure to implement more robust security measures for their OT systems. Consumers may experience increased prices as supermarkets factor in the cost of potential future disruptions and enhanced security protocols.